The authentication procedure is described in the following steps:
- The host writes 0x00 to 0x3E.
- The host writes 0x00 to 0x3F.
- Write the random challenge as a 32-byte block to address 0x40–0x5F. The challenge should be a 256-bit (32-byte) random number generated from a cryptographically secure source on the host processor.
- Write the checksum (1's complement sum of (1), (2), and (3)) to address 0x60.
- Write the length 0x24 to address 0x61.
- The gauge will compute the HMAC using SHA-256 after step (5). The [AUTH] bit in OperationStatusB() is set to 1 during computation. Wait 200 ms. (60 ms is how long authentication takes, but extra margin is added).
- The MACData() command will contain the computed HMAC result using SHA-256. The response format depends on Settings:Configuration:Auth Config[SPLIT_RESPONSE]:
- [SPLIT_RESPONSE] = 0: Single 60-byte response containing command echo (2 bytes) + HMAC (32 bytes) + challenge echo (26 bytes).
- [SPLIT_RESPONSE] = 1: Response split into two 30-byte fields. Host must read twice to get complete response.
- [AUTH] = 0 in OperationStatusB() when computation completes and response is ready.
Authentication Timing
The following timing details apply to the authentication process:
- Recommended Wait Time: 200 ms to ensure reliable operation across all conditions.
- Polling Method: Alternatively, poll OperationStatusB()[AUTH] until it clears (0) to detect completion.
Host Verification
To verify authentication:
- The host computes HMAC-SHA256 using the same 32-byte challenge and the shared 256-bit secret key.
- The host reads the HMAC response from MACData().
- The host compares its computed HMAC with the gauge's response.
- If the HMACs match, the battery pack is authenticated as genuine.